@ia-qa/self-healing 1.6.7 → 1.6.10

package/dist/ui/shortcut.d.ts

@@ -0,0 +1,90 @@
+/**
+ * A desktop shortcut that opens this project's console — `ia-qa-heal ui --shortcut`.
+ *
+ * The console already opens a browser by itself, so the only thing standing
+ * between a manual QA and their drift report is a terminal they have no reason
+ * to own. This removes it: double-click an icon, the console starts in the
+ * right project directory and the browser opens on it. No URL is ever typed,
+ * copied, or seen — which is also what keeps the session token out of the way
+ * instead of making it something a person has to handle.
+ *
+ * Nothing about the icon is cosmetic-only: an unlabelled `.cmd` on a desktop is
+ * a file people are right to be wary of double-clicking.
+ *
+ * **Per platform, and the honest limits.**
+ *
+ * - **Windows** — a real `.lnk`, which is the only shape that can carry a custom
+ *   icon. It is created by shelling out to PowerShell's `WScript.Shell` (present
+ *   on every supported Windows, and not a dependency), and it targets a `.cmd`
+ *   kept *inside* the project rather than a second file on the desktop. If
+ *   PowerShell refuses, the `.cmd` is placed on the desktop instead and the
+ *   caller says so — a working shortcut with the default icon beats none.
+ * - **Linux** — a `.desktop` entry, whose `Icon=` takes the PNG directly.
+ * - **macOS** — a `.command`, with the **system's default icon**. Setting a
+ *   custom one needs a resource fork via `Rez`/`fileicon` or Finder scripting;
+ *   both are fragile and neither is worth a silent failure. Stated, not hidden.
+ */
+export type Platform = 'win32' | 'darwin' | 'linux';
+export interface ShortcutFile {
+    file: string;
+    contents: string;
+    mode?: number;
+}
+/** A Windows `.lnk`, which cannot be written as text — see `installShortcut`. */
+export interface LnkPlan {
+    file: string;
+    target: string;
+    workingDir: string;
+    iconPath: string;
+    description: string;
+}
+export interface ShortcutPlan {
+    /** Plain-text files to write, in order. */
+    files: ShortcutFile[];
+    /** Present on Windows only. */
+    lnk?: LnkPlan;
+    /** Where the .ico has to be written for the lnk to find it. */
+    icoPath?: string;
+    /** True when this platform gets the system's default icon. */
+    defaultIconOnly?: boolean;
+}
+/**
+ * The desktop name. It carries the site because this icon sits on the desktop
+ * of every QA who uses the tool, which makes it the cheapest honest place to
+ * say where it comes from — and because "console" alone, months later, names
+ * nothing.
+ */
+export declare const SHORTCUT_NAME = "ia-qa-heal console (ia-qa.com)";
+/**
+ * What would be written, without writing it. Split out so the shape of every
+ * platform's launcher is testable on any platform — the one thing that would
+ * otherwise only ever be exercised on the maintainer's own OS.
+ */
+export declare function planShortcut(opts: {
+    platform: Platform;
+    desktop: string;
+    projectDir: string;
+    configDir: string;
+    nodePath: string;
+    cliEntry: string;
+    logoPath: string;
+    name?: string;
+}): ShortcutPlan;
+/**
+ * Create the Windows `.lnk`. PowerShell's COM shell object is the only way to
+ * write one without either a native module or hand-assembling the binary Shell
+ * Link format. Returns false rather than throwing: the caller has a working
+ * fallback and a shortcut is not worth failing a command over.
+ *
+ * Every value is passed as an environment variable, never interpolated into the
+ * script text — a project path containing a quote would otherwise end up being
+ * executed as PowerShell.
+ */
+export declare function createWindowsLnk(lnk: LnkPlan): boolean;
+/**
+ * Where the desktop is. `XDG_DESKTOP_DIR` and localized folder names exist and
+ * are not resolvable without reading user config, so a missing `Desktop` falls
+ * back to the home directory rather than guessing wrong and writing an icon
+ * nobody finds.
+ */
+export declare function desktopDir(home?: string): string;

package/dist/ui/shortcut.js

@@ -0,0 +1,176 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHORTCUT_NAME = void 0;
+exports.planShortcut = planShortcut;
+exports.createWindowsLnk = createWindowsLnk;
+exports.desktopDir = desktopDir;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * The desktop name. It carries the site because this icon sits on the desktop
+ * of every QA who uses the tool, which makes it the cheapest honest place to
+ * say where it comes from — and because "console" alone, months later, names
+ * nothing.
+ */
+exports.SHORTCUT_NAME = 'ia-qa-heal console (ia-qa.com)';
+function quoteWin(s) {
+    return `"${s.replace(/"/g, '""')}"`;
+}
+function quotePosix(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/**
+ * What would be written, without writing it. Split out so the shape of every
+ * platform's launcher is testable on any platform — the one thing that would
+ * otherwise only ever be exercised on the maintainer's own OS.
+ */
+function planShortcut(opts) {
+    const name = opts.name ?? exports.SHORTCUT_NAME;
+    const description = 'Open the local selector-drift console for this project — ia-qa.com';
+    if (opts.platform === 'win32') {
+        // The .cmd lives in the project, not on the desktop: the desktop gets one
+        // icon, not a launcher plus its helper.
+        const cmd = path.join(opts.configDir, 'console.cmd');
+        return {
+            files: [
+                {
+                    file: cmd,
+                    contents: `@echo off\r\n` +
+                        `title ${name}\r\n` +
+                        `cd /d ${quoteWin(opts.projectDir)}\r\n` +
+                        `echo  ia-qa-heal console  -  ia-qa.com\r\n` +
+                        `echo  Starting... your browser will open on its own.\r\n` +
+                        `echo  Close this window to stop it.\r\n` +
+                        `echo.\r\n` +
+                        `${quoteWin(opts.nodePath)} ${quoteWin(opts.cliEntry)} ui\r\n` +
+                        `if errorlevel 1 pause\r\n`,
+                },
+            ],
+            lnk: {
+                file: path.join(opts.desktop, `${name}.lnk`),
+                target: cmd,
+                workingDir: opts.projectDir,
+                iconPath: path.join(opts.configDir, 'console.ico'),
+                description,
+            },
+            icoPath: path.join(opts.configDir, 'console.ico'),
+        };
+    }
+    if (opts.platform === 'darwin') {
+        return {
+            files: [
+                {
+                    file: path.join(opts.desktop, `${name}.command`),
+                    contents: `#!/bin/sh\n` +
+                        `# ${description}\n` +
+                        `cd ${quotePosix(opts.projectDir)} || exit 1\n` +
+                        `echo " ia-qa-heal console  -  ia-qa.com"\n` +
+                        `echo " Starting... your browser will open on its own."\n` +
+                        `echo " Close this window to stop it."\n` +
+                        `exec ${quotePosix(opts.nodePath)} ${quotePosix(opts.cliEntry)} ui\n`,
+                    mode: 0o755,
+                },
+            ],
+            defaultIconOnly: true,
+        };
+    }
+    return {
+        files: [
+            {
+                file: path.join(opts.desktop, `${name}.desktop`),
+                contents: `[Desktop Entry]\n` +
+                    `Type=Application\n` +
+                    `Name=${name}\n` +
+                    `Comment=${description}\n` +
+                    `Icon=${opts.logoPath}\n` +
+                    `Exec=sh -c "cd ${quotePosix(opts.projectDir)} && ${quotePosix(opts.nodePath)} ${quotePosix(opts.cliEntry)} ui"\n` +
+                    `Terminal=true\n` +
+                    `Categories=Development;\n`,
+                mode: 0o755,
+            },
+        ],
+    };
+}
+/**
+ * Create the Windows `.lnk`. PowerShell's COM shell object is the only way to
+ * write one without either a native module or hand-assembling the binary Shell
+ * Link format. Returns false rather than throwing: the caller has a working
+ * fallback and a shortcut is not worth failing a command over.
+ *
+ * Every value is passed as an environment variable, never interpolated into the
+ * script text — a project path containing a quote would otherwise end up being
+ * executed as PowerShell.
+ */
+function createWindowsLnk(lnk) {
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const { execFileSync } = require('child_process');
+    const script = '$s = (New-Object -ComObject WScript.Shell).CreateShortcut($env:IAQA_LNK); ' +
+        '$s.TargetPath = $env:IAQA_TARGET; ' +
+        '$s.WorkingDirectory = $env:IAQA_CWD; ' +
+        '$s.Description = $env:IAQA_DESC; ' +
+        'if (Test-Path $env:IAQA_ICON) { $s.IconLocation = $env:IAQA_ICON }; ' +
+        '$s.Save()';
+    try {
+        execFileSync('powershell.exe', ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script], {
+            stdio: 'ignore',
+            timeout: 15000,
+            env: {
+                ...process.env,
+                IAQA_LNK: lnk.file,
+                IAQA_TARGET: lnk.target,
+                IAQA_CWD: lnk.workingDir,
+                IAQA_DESC: lnk.description,
+                IAQA_ICON: lnk.iconPath,
+            },
+        });
+        return fs.existsSync(lnk.file);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Where the desktop is. `XDG_DESKTOP_DIR` and localized folder names exist and
+ * are not resolvable without reading user config, so a missing `Desktop` falls
+ * back to the home directory rather than guessing wrong and writing an icon
+ * nobody finds.
+ */
+function desktopDir(home = os.homedir()) {
+    const candidate = path.join(home, 'Desktop');
+    return fs.existsSync(candidate) ? candidate : home;
+}
+//# sourceMappingURL=shortcut.js.map

package/dist/ui/shortcut.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shortcut.js","sourceRoot":"","sources":["../../src/ui/shortcut.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFA,oCAiFC;AAYD,4CA+BC;AAQD,gCAGC;AAvND,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAyD7B;;;;;GAKG;AACU,QAAA,aAAa,GAAG,gCAAgC,CAAC;AAE9D,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAS5B;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,qBAAa,CAAC;IACxC,MAAM,WAAW,GAAG,oEAAoE,CAAC;IAEzF,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,0EAA0E;QAC1E,wCAAwC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACrD,OAAO;YACL,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,GAAG;oBACT,QAAQ,EACN,eAAe;wBACf,SAAS,IAAI,MAAM;wBACnB,SAAS,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM;wBACxC,4CAA4C;wBAC5C,0DAA0D;wBAC1D,yCAAyC;wBACzC,WAAW;wBACX,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;wBAC9D,2BAA2B;iBAC9B;aACF;YACD,GAAG,EAAE;gBACH,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,MAAM,CAAC;gBAC5C,MAAM,EAAE,GAAG;gBACX,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;gBAClD,WAAW;aACZ;YACD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;SAClD,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO;YACL,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC;oBAChD,QAAQ,EACN,aAAa;wBACb,KAAK,WAAW,IAAI;wBACpB,MAAM,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc;wBAC/C,4CAA4C;wBAC5C,0DAA0D;wBAC1D,yCAAyC;wBACzC,QAAQ,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;oBACvE,IAAI,EAAE,KAAK;iBACZ;aACF;YACD,eAAe,EAAE,IAAI;SACtB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC;gBAChD,QAAQ,EACN,mBAAmB;oBACnB,oBAAoB;oBACpB,QAAQ,IAAI,IAAI;oBAChB,WAAW,WAAW,IAAI;oBAC1B,QAAQ,IAAI,CAAC,QAAQ,IAAI;oBACzB,kBAAkB,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ;oBAClH,iBAAiB;oBACjB,2BAA2B;gBAC7B,IAAI,EAAE,KAAK;aACZ;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,8DAA8D;IAC9D,MAAM,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,eAAe,CAAmC,CAAC;IACpF,MAAM,MAAM,GACV,4EAA4E;QAC5E,oCAAoC;QACpC,uCAAuC;QACvC,mCAAmC;QACnC,sEAAsE;QACtE,WAAW,CAAC;IACd,IAAI,CAAC;QACH,YAAY,CACV,gBAAgB,EAChB,CAAC,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,EACnF;YACE,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,KAAK;YACd,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,QAAQ,EAAE,GAAG,CAAC,IAAI;gBAClB,WAAW,EAAE,GAAG,CAAC,MAAM;gBACvB,QAAQ,EAAE,GAAG,CAAC,UAAU;gBACxB,SAAS,EAAE,GAAG,CAAC,WAAW;gBAC1B,SAAS,EAAE,GAAG,CAAC,QAAQ;aACxB;SACF,CACF,CAAC;QACF,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,UAAU,CAAC,OAAe,EAAE,CAAC,OAAO,EAAE;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC"}

package/dist/update.d.ts

@@ -0,0 +1,104 @@
+/**
+ * "You are running a version from six months ago" — the one fact the console's
+ * audience cannot obtain any other way.
+ *
+ * Every other door to this package resolves its own version already. An agent
+ * follows the documented MCP config, which is `npx -y -p @ia-qa/self-healing
+ * ia-qa-heal-mcp`: npx resolves the `latest` dist-tag on every server start, so
+ * the resolution *is* the check and nothing needs adding. A developer has a
+ * shell and `npm outdated`. The desktop shortcut has neither: it writes an
+ * absolute path to `node` plus `dist/cli/index.js`, so the console launches the
+ * bytes that are on disk, forever, and its whole premise is that the person
+ * clicking it does not own a terminal. That is the gap this fills, and the only
+ * one.
+ *
+ * **Why this is allowed to touch the network at all.** The package's claim is
+ * local-first, and that claim has to survive this file. Four constraints keep it
+ * true, and none of them are optional:
+ *
+ * 1. **It carries nothing.** A GET for a public package's dist-tags — 18 bytes
+ *    back, no query, no body, no header about this machine. The user's app, test
+ *    files, contracts, verdicts and history are not involved and never will be.
+ *    npm learns an IP already knew when the package was installed from it.
+ * 2. **Once a day, from a cache** on this machine (`~/.ia-qa/update-check.json`,
+ *    `IAQA_HOME` relocates it — same home as the project registry). Not once per
+ *    request, and never from the page: the console's CSP is `connect-src 'self'`
+ *    and stays that way, so the browser cannot reach a registry even if this
+ *    file were wrong.
+ * 3. **Announced before it happens**, in the terminal, naming the host — the
+ *    same manners `check` observes before it touches the user's own baseUrl.
+ * 4. **`--offline` removes it**, and a failure is silent: no network, a proxy, a
+ *    404, a hang past the timeout all degrade to "no banner". A version notice
+ *    that could break someone's console would be worth strictly less than zero.
+ *
+ * And it stays a *notice*. Nothing here installs anything. The console spawns
+ * this package's own CLI with an allowlisted argv and that is the entirety of
+ * its authority (`ui/server.ts`); `npm install` is a different binary that runs
+ * arbitrary lifecycle scripts off the registry, so putting it behind a button
+ * would trade a bounded blast radius — "edits my test files" — for an unbounded
+ * one, on the strength of a token that is only meant to guard the former. The
+ * banner therefore ends at the command to paste.
+ */
+export declare const PACKAGE_NAME = "@ia-qa/self-healing";
+export declare const REGISTRY_HOST = "registry.npmjs.org";
+export interface UpdateCache {
+    checkedAt: string;
+    latest: string;
+}
+export type InstallKind = 'global' | 'project' | 'npx' | 'checkout';
+export interface InstallSite {
+    kind: InstallKind;
+    root?: string;
+    /** What to paste. `null` when there is nothing to do. */
+    command: string | null;
+    how: string;
+}
+export interface UpdateNotice extends InstallSite {
+    current: string;
+    latest: string;
+    checkedAt: string;
+    /** Named in the banner: a host the reader can recognise beats "online somewhere". */
+    registry: string;
+}
+/** The version actually running. `dist/update.js` and `src/update.ts` are both one level down. */
+export declare function currentVersion(): string;
+/**
+ * Is `latest` ahead of `current`? Deliberately not a semver dependency: three
+ * integers is the whole of what a dist-tag comparison needs, and anything it
+ * cannot parse returns false — an unreadable version must produce no banner
+ * rather than a wrong one. Pre-release suffixes are dropped, so a `1.7.0-rc.1`
+ * on this machine is not told to "update" to `1.6.9`.
+ */
+export declare function isNewer(latest: string, current: string): boolean;
+export declare function cachePath(home?: string): string;
+export declare function readCache(home?: string): UpdateCache | null;
+/** Would a launch actually make a request? What the announcement is gated on. */
+export declare function updateCheckDue(home?: string, now?: number): boolean;
+/** Resolves to `null` on every failure — no network, non-200, junk body, timeout. */
+export declare function fetchLatest(timeoutMs?: number): Promise<string | null>;
+/**
+ * Refresh the cached answer if it has aged out. Returns whatever is known —
+ * including a stale entry when the request failed, because losing yesterday's
+ * answer to a flaky network helps nobody. Never throws and never rejects.
+ */
+export declare function refreshUpdateCache(opts?: {
+    home?: string;
+    fetch?: () => Promise<string | null>;
+}): Promise<UpdateCache | null>;
+/**
+ * How this copy got here, so the banner can name *the* command instead of
+ * listing three and making the reader choose — which is the actual friction for
+ * someone who does not own a terminal.
+ *
+ * The signal is the path, not a symlink probe: Node resolves module paths
+ * through symlinks by default, so an `npm link`ed package reports the checkout
+ * it points at rather than the `node_modules` entry. "Is there a `node_modules`
+ * ancestor" survives that, and the published tarball ships no `src/`, so a path
+ * outside `node_modules` is a working copy by construction.
+ */
+export declare function describeInstall(pkgRoot?: string): InstallSite;
+/**
+ * The banner's payload, or `null` when there is nothing to say. Reads the cache
+ * only — building the page must never wait on a socket.
+ */
+export declare function updateNotice(home?: string, pkgRoot?: string): UpdateNotice | null;

package/dist/update.js

@@ -0,0 +1,297 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REGISTRY_HOST = exports.PACKAGE_NAME = void 0;
+exports.currentVersion = currentVersion;
+exports.isNewer = isNewer;
+exports.cachePath = cachePath;
+exports.readCache = readCache;
+exports.updateCheckDue = updateCheckDue;
+exports.fetchLatest = fetchLatest;
+exports.refreshUpdateCache = refreshUpdateCache;
+exports.describeInstall = describeInstall;
+exports.updateNotice = updateNotice;
+const fs = __importStar(require("fs"));
+const https = __importStar(require("https"));
+const path = __importStar(require("path"));
+const registry_1 = require("./ui/registry");
+/**
+ * "You are running a version from six months ago" — the one fact the console's
+ * audience cannot obtain any other way.
+ *
+ * Every other door to this package resolves its own version already. An agent
+ * follows the documented MCP config, which is `npx -y -p @ia-qa/self-healing
+ * ia-qa-heal-mcp`: npx resolves the `latest` dist-tag on every server start, so
+ * the resolution *is* the check and nothing needs adding. A developer has a
+ * shell and `npm outdated`. The desktop shortcut has neither: it writes an
+ * absolute path to `node` plus `dist/cli/index.js`, so the console launches the
+ * bytes that are on disk, forever, and its whole premise is that the person
+ * clicking it does not own a terminal. That is the gap this fills, and the only
+ * one.
+ *
+ * **Why this is allowed to touch the network at all.** The package's claim is
+ * local-first, and that claim has to survive this file. Four constraints keep it
+ * true, and none of them are optional:
+ *
+ * 1. **It carries nothing.** A GET for a public package's dist-tags — 18 bytes
+ *    back, no query, no body, no header about this machine. The user's app, test
+ *    files, contracts, verdicts and history are not involved and never will be.
+ *    npm learns an IP already knew when the package was installed from it.
+ * 2. **Once a day, from a cache** on this machine (`~/.ia-qa/update-check.json`,
+ *    `IAQA_HOME` relocates it — same home as the project registry). Not once per
+ *    request, and never from the page: the console's CSP is `connect-src 'self'`
+ *    and stays that way, so the browser cannot reach a registry even if this
+ *    file were wrong.
+ * 3. **Announced before it happens**, in the terminal, naming the host — the
+ *    same manners `check` observes before it touches the user's own baseUrl.
+ * 4. **`--offline` removes it**, and a failure is silent: no network, a proxy, a
+ *    404, a hang past the timeout all degrade to "no banner". A version notice
+ *    that could break someone's console would be worth strictly less than zero.
+ *
+ * And it stays a *notice*. Nothing here installs anything. The console spawns
+ * this package's own CLI with an allowlisted argv and that is the entirety of
+ * its authority (`ui/server.ts`); `npm install` is a different binary that runs
+ * arbitrary lifecycle scripts off the registry, so putting it behind a button
+ * would trade a bounded blast radius — "edits my test files" — for an unbounded
+ * one, on the strength of a token that is only meant to guard the former. The
+ * banner therefore ends at the command to paste.
+ */
+exports.PACKAGE_NAME = '@ia-qa/self-healing';
+exports.REGISTRY_HOST = 'registry.npmjs.org';
+/** Just the dist-tags document, not the package metadata — 18 bytes, not 200 kB. */
+const DIST_TAGS_PATH = '/-/package/@ia-qa%2fself-healing/dist-tags';
+const TTL_MS = 24 * 60 * 60 * 1000;
+const TIMEOUT_MS = 2500;
+/** The version actually running. `dist/update.js` and `src/update.ts` are both one level down. */
+function currentVersion() {
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-var-requires
+        return require('../package.json').version;
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+/**
+ * Is `latest` ahead of `current`? Deliberately not a semver dependency: three
+ * integers is the whole of what a dist-tag comparison needs, and anything it
+ * cannot parse returns false — an unreadable version must produce no banner
+ * rather than a wrong one. Pre-release suffixes are dropped, so a `1.7.0-rc.1`
+ * on this machine is not told to "update" to `1.6.9`.
+ */
+function isNewer(latest, current) {
+    const parse = (v) => String(v ?? '')
+        .trim()
+        .replace(/^v/, '')
+        .split(/[-+]/)[0]
+        .split('.')
+        .map((n) => Number.parseInt(n, 10));
+    const a = parse(latest);
+    const b = parse(current);
+    if (a.length === 0 || a.some((n) => !Number.isFinite(n)))
+        return false;
+    if (b.length === 0 || b.some((n) => !Number.isFinite(n)))
+        return false;
+    for (let i = 0; i < 3; i++) {
+        if ((a[i] ?? 0) !== (b[i] ?? 0))
+            return (a[i] ?? 0) > (b[i] ?? 0);
+    }
+    return false;
+}
+function cachePath(home) {
+    return path.join((0, registry_1.registryDir)(home), 'update-check.json');
+}
+function readCache(home) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(cachePath(home), 'utf8'));
+        if (typeof parsed?.latest !== 'string' || typeof parsed?.checkedAt !== 'string')
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Would a launch actually make a request? What the announcement is gated on. */
+function updateCheckDue(home, now = Date.now()) {
+    const cache = readCache(home);
+    if (!cache)
+        return true;
+    const at = Date.parse(cache.checkedAt);
+    return !Number.isFinite(at) || now - at >= TTL_MS || at > now;
+}
+/** Resolves to `null` on every failure — no network, non-200, junk body, timeout. */
+function fetchLatest(timeoutMs = TIMEOUT_MS) {
+    return new Promise((resolve) => {
+        let done = false;
+        const finish = (v) => {
+            if (!done) {
+                done = true;
+                resolve(v);
+            }
+        };
+        try {
+            const req = https.get({
+                host: exports.REGISTRY_HOST,
+                path: DIST_TAGS_PATH,
+                headers: { accept: 'application/json', 'user-agent': `${exports.PACKAGE_NAME}/${currentVersion()}` },
+                timeout: timeoutMs,
+            }, (res) => {
+                if (res.statusCode !== 200) {
+                    res.resume();
+                    return finish(null);
+                }
+                let body = '';
+                res.setEncoding('utf8');
+                res.on('data', (c) => {
+                    body += c;
+                    if (body.length > 8192) {
+                        req.destroy();
+                        finish(null);
+                    }
+                });
+                res.on('end', () => {
+                    try {
+                        const tag = JSON.parse(body).latest;
+                        finish(typeof tag === 'string' && tag ? tag : null);
+                    }
+                    catch {
+                        finish(null);
+                    }
+                });
+            });
+            req.on('timeout', () => {
+                req.destroy();
+                finish(null);
+            });
+            req.on('error', () => finish(null));
+        }
+        catch {
+            finish(null);
+        }
+    });
+}
+/**
+ * Refresh the cached answer if it has aged out. Returns whatever is known —
+ * including a stale entry when the request failed, because losing yesterday's
+ * answer to a flaky network helps nobody. Never throws and never rejects.
+ */
+async function refreshUpdateCache(opts = {}) {
+    const cached = readCache(opts.home);
+    if (!updateCheckDue(opts.home))
+        return cached;
+    const latest = await (opts.fetch ?? (() => fetchLatest()))().catch(() => null);
+    if (!latest)
+        return cached;
+    const next = { checkedAt: new Date().toISOString(), latest };
+    try {
+        fs.mkdirSync((0, registry_1.registryDir)(opts.home), { recursive: true });
+        fs.writeFileSync(cachePath(opts.home), JSON.stringify(next, null, 2) + '\n', {
+            encoding: 'utf8',
+            mode: 0o600,
+        });
+    }
+    catch {
+        /* an uncacheable answer just means we ask again next launch */
+    }
+    return next;
+}
+/**
+ * How this copy got here, so the banner can name *the* command instead of
+ * listing three and making the reader choose — which is the actual friction for
+ * someone who does not own a terminal.
+ *
+ * The signal is the path, not a symlink probe: Node resolves module paths
+ * through symlinks by default, so an `npm link`ed package reports the checkout
+ * it points at rather than the `node_modules` entry. "Is there a `node_modules`
+ * ancestor" survives that, and the published tarball ships no `src/`, so a path
+ * outside `node_modules` is a working copy by construction.
+ */
+function describeInstall(pkgRoot = path.resolve(__dirname, '..')) {
+    const parts = pkgRoot.split(/[\\/]/);
+    const i = parts.lastIndexOf('node_modules');
+    if (i === -1) {
+        return {
+            kind: 'checkout',
+            root: pkgRoot,
+            command: null,
+            how: 'This console is running from a source checkout, not from an installed package. Update that checkout the way you normally would.',
+        };
+    }
+    const root = parts.slice(0, i).join(path.sep) || path.sep;
+    // npx keeps its own tree under the npm cache and re-resolves `latest` on every
+    // invocation, so this copy is already as current as its last start. Telling
+    // someone to install would be advice that makes their setup worse.
+    if (/[\\/]_npx[\\/]/.test(pkgRoot + path.sep)) {
+        return {
+            kind: 'npx',
+            root,
+            command: null,
+            how: 'Started through npx, which fetches the newest version every time it runs. Close it and start it again to pick this one up — there is nothing to install.',
+        };
+    }
+    if (fs.existsSync(path.join(root, 'package.json'))) {
+        return {
+            kind: 'project',
+            root,
+            command: `npm i -D ${exports.PACKAGE_NAME}@latest`,
+            how: `Installed inside this project. Run this from ${root}:`,
+        };
+    }
+    return {
+        kind: 'global',
+        root,
+        command: `npm i -g ${exports.PACKAGE_NAME}@latest`,
+        how: 'Installed once for this whole machine. Run this in any terminal:',
+    };
+}
+/**
+ * The banner's payload, or `null` when there is nothing to say. Reads the cache
+ * only — building the page must never wait on a socket.
+ */
+function updateNotice(home, pkgRoot) {
+    const cache = readCache(home);
+    const current = currentVersion();
+    if (!cache || !isNewer(cache.latest, current))
+        return null;
+    return {
+        ...describeInstall(pkgRoot),
+        current,
+        latest: cache.latest,
+        checkedAt: cache.checkedAt,
+        registry: exports.REGISTRY_HOST,
+    };
+}
+//# sourceMappingURL=update.js.map